CONF Colbois_IJCB_2023/IDIAP Approximating Optimal Morphing Attacks using Template Inversion Colbois, Laurent Otroshi Shahreza, Hatef Marcel, Sébastien EXTERNAL http://publications.idiap.ch/attachments/papers/2023/Colbois_IJCB_2023.pdf PUBLIC http://publications.idiap.ch/index.php/publications/showcite/Colbois_Idiap-RR-07-2023 Related documents IEEE International Joint Conference on Biometric 2023 2474-9680 979-8-3503-3726-6 https://doi.org/10.1109/IJCB57857.2023.10448752 doi Recent works have demonstrated the feasibility of inverting face recognition systems, enabling to recover convincing face images using only their embeddings. We leverage such template inversion models to develop a novel type of deep morphing attack based on inverting a theoretical optimal morph embedding, which is obtained as an average of the face embeddings of source images. We experiment with two variants of this approach : the first one exploits a fully self-contained embedding-to-image inversion model, while the second leverages the synthesis network of a pretrained StyleGAN for increased morph realism. We generate morphing attacks from several source datasets and study the effectiveness of those attacks against several face recognition networks. We showcase that our method can compete with and regularly beat the previous state of the art for deep-learning based morph generation in terms of effectiveness, both in white-box and black-box attack scenarios, and is additionally much faster to run. We hope this might facilitate the development of large scale deep morph datasets for training detection models. REPORT Colbois_Idiap-RR-07-2023/IDIAP Approximating Optimal Morphing Attacks using Template Inversion Colbois, Laurent Otroshi Shahreza, Hatef Marcel, Sébastien EXTERNAL http://publications.idiap.ch/attachments/reports/2023/Colbois_Idiap-RR-07-2023.pdf PUBLIC Idiap-RR-07-2023 2023 Idiap July 2023 Submited to the International Joint Conference on Biometrics (IJCB 2023) Recent works have demonstrated the feasibility of inverting face recognition systems, enabling to recover convincing face images using only their embeddings. We leverage such template inversion models to develop a novel type of deep morphing attack based on inverting a theoretical optimal morph embedding, which is obtained as an average of the face embeddings of source images. We experiment with two variants of this approach : the first one exploits a fully self-contained embedding-to-image inversion model, while the second leverages the synthesis network of a pretrained StyleGAN for increased morph realism. We generate morphing attacks from several source datasets and study the effectiveness of those attacks against several face recognition networks. We showcase that our method can compete with and regularly beat the previous state of the art for deep-learning based morph generation in terms of effectiveness, both in white-box and black-box attack scenarios, and is additionally much faster to run. We hope this might facilitate the development of large scale deep morph datasets for training detection models.